clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 18:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Moved buffer from heap to stack

Browse Source
This commit is contained in:
Julien Pauli 2016-01-04 14:46:57 +01:00
parent 1e1c5c427e
commit ef4dc15831
1 changed files with 14 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
ext/standard/password.c
View File

@ -261,7 +261,7 @@ PHP_FUNCTION(password_verify)
Hash a password */ Hash a password */
PHP_FUNCTION(password_hash) PHP_FUNCTION(password_hash)
{ {
char *hash_format, *hash, *salt, *password; char hash_format[8], *hash, *salt, *password;
zend_long algo = 0; zend_long algo = 0;
size_t password_len = 0; size_t password_len = 0;
int hash_len; int hash_len;
@ -289,7 +289,6 @@ PHP_FUNCTION(password_hash)
} }
required_salt_len = 22; required_salt_len = 22;
hash_format = emalloc(8);
sprintf(hash_format, "$2y$%02ld$", (long) cost); sprintf(hash_format, "$2y$%02ld$", (long) cost);
hash_format_len = 7; hash_format_len = 7;
} }
@ -301,33 +300,25 @@ PHP_FUNCTION(password_hash)
} }
if (options && (option_buffer = zend_hash_str_find(options, "salt", sizeof("salt")-1)) != NULL) { if (options && (option_buffer = zend_hash_str_find(options, "salt", sizeof("salt")-1)) != NULL) {
char *buffer; zend_string *buffer;
size_t buffer_len = 0;
php_error_docref(NULL, E_DEPRECATED, "Use of the 'salt' option to password_hash is deprecated"); php_error_docref(NULL, E_DEPRECATED, "Use of the 'salt' option to password_hash is deprecated");
switch (Z_TYPE_P(option_buffer)) { switch (Z_TYPE_P(option_buffer)) {
case IS_STRING: case IS_STRING:
buffer = estrndup(Z_STRVAL_P(option_buffer), Z_STRLEN_P(option_buffer)); buffer = zend_string_copy(Z_STR_P(option_buffer));
buffer_len = Z_STRLEN_P(option_buffer);
break; break;
case IS_LONG: case IS_LONG:
case IS_DOUBLE: case IS_DOUBLE:
case IS_OBJECT: case IS_OBJECT:
{ buffer = zval_get_string(option_buffer);
zend_string *tmp = zval_get_string(option_buffer);
buffer = estrndup(ZSTR_VAL(tmp), ZSTR_LEN(tmp));
buffer_len = ZSTR_LEN(tmp);
zend_string_release(tmp);
break; break;
}
case IS_FALSE: case IS_FALSE:
case IS_TRUE: case IS_TRUE:
case IS_NULL: case IS_NULL:
case IS_RESOURCE: case IS_RESOURCE:
case IS_ARRAY: case IS_ARRAY:
default: default:
efree(hash_format);
php_error_docref(NULL, E_WARNING, "Non-string salt parameter supplied"); php_error_docref(NULL, E_WARNING, "Non-string salt parameter supplied");
RETURN_NULL(); RETURN_NULL();
} }
@ -335,36 +326,31 @@ PHP_FUNCTION(password_hash)
/* XXX all the crypt related APIs work with int for string length. /* XXX all the crypt related APIs work with int for string length.
That should be revised for size_t and then we maybe don't require That should be revised for size_t and then we maybe don't require
the > INT_MAX check. */ the > INT_MAX check. */
if (buffer_len > INT_MAX) { if (ZSTR_LEN(buffer) > INT_MAX) {
efree(hash_format);
efree(buffer);
php_error_docref(NULL, E_WARNING, "Supplied salt is too long"); php_error_docref(NULL, E_WARNING, "Supplied salt is too long");
RETURN_NULL(); RETURN_NULL();
} else if (buffer_len < required_salt_len) { } else if (ZSTR_LEN(buffer) < required_salt_len) {
efree(hash_format); php_error_docref(NULL, E_WARNING, "Provided salt is too short: %zd expecting %zd", ZSTR_LEN(buffer), required_salt_len);
efree(buffer); zend_string_release(buffer);
php_error_docref(NULL, E_WARNING, "Provided salt is too short: %zd expecting %zd", buffer_len, required_salt_len);
RETURN_NULL(); RETURN_NULL();
} else if (php_password_salt_is_alphabet(buffer, buffer_len) == FAILURE) { } else if (php_password_salt_is_alphabet(ZSTR_VAL(buffer), ZSTR_LEN(buffer)) == FAILURE) {
salt = safe_emalloc(required_salt_len, 1, 1); salt = safe_emalloc(required_salt_len, 1, 1);
if (php_password_salt_to64(buffer, buffer_len, required_salt_len, salt) == FAILURE) { if (php_password_salt_to64(ZSTR_VAL(buffer), ZSTR_LEN(buffer), required_salt_len, salt) == FAILURE) {
efree(hash_format);
efree(buffer);
efree(salt); efree(salt);
php_error_docref(NULL, E_WARNING, "Provided salt is too short: %zd", buffer_len); php_error_docref(NULL, E_WARNING, "Provided salt is too short: %zd", ZSTR_LEN(buffer));
zend_string_release(buffer);
RETURN_NULL(); RETURN_NULL();
} }
salt_len = required_salt_len; salt_len = required_salt_len;
} else { } else {
salt = safe_emalloc(required_salt_len, 1, 1); salt = safe_emalloc(required_salt_len, 1, 1);
memcpy(salt, buffer, required_salt_len); memcpy(salt, ZSTR_VAL(buffer), required_salt_len);
salt_len = required_salt_len; salt_len = required_salt_len;
} }
efree(buffer); zend_string_release(buffer);
} else { } else {
salt = safe_emalloc(required_salt_len, 1, 1); salt = safe_emalloc(required_salt_len, 1, 1);
if (php_password_make_salt(required_salt_len, salt) == FAILURE) { if (php_password_make_salt(required_salt_len, salt) == FAILURE) {
efree(hash_format);
efree(salt); efree(salt);
RETURN_FALSE; RETURN_FALSE;
} }
@ -377,7 +363,6 @@ PHP_FUNCTION(password_hash)
sprintf(hash, "%s%s", hash_format, salt); sprintf(hash, "%s%s", hash_format, salt);
hash[hash_format_len + salt_len] = 0; hash[hash_format_len + salt_len] = 0;
efree(hash_format);
efree(salt); efree(salt);
/* This cast is safe, since both values are defined here in code and cannot overflow */ /* This cast is safe, since both values are defined here in code and cannot overflow */